Not sure what the difference is, but it will not allow you to run it when using a service principal with workload identity federation.